Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'mm-hotfixes-stable-2025-06-13-21-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull misc fixes from Andrew Morton:
"9 hotfixes. 3 are cc:stable and the remainder address post-6.15 issues
or aren't considered necessary for -stable kernels. Only 4 are for MM"
* tag 'mm-hotfixes-stable-2025-06-13-21-56' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm: add mmap_prepare() compatibility layer for nested file systems
init: fix build warnings about export.h
MAINTAINERS: add Barry as a THP reviewer
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
mm: close theoretical race where stale TLB entries could linger
mm/vma: reset VMA iterator on commit_merge() OOM failure
docs: proc: update VmFlags documentation in smaps
scatterlist: fix extraneous '@'-sign kernel-doc notation
selftests/mm: skip failed memfd setups in gup_longterm
+134
-29
+3
-1
Documentation/filesystems/proc.rst
+3
-1
Documentation/filesystems/proc.rst
···
584
584
ms may share
585
585
gd stack segment growns down
586
586
pf pure PFN range
587
-
dw disabled write to the mapped file
588
587
lo pages are locked in memory
589
588
io memory mapped I/O area
590
589
sr sequential read advise provided
···
606
607
mt arm64 MTE allocation tags are enabled
607
608
um userfaultfd missing tracking
608
609
uw userfaultfd wr-protect tracking
610
+
ui userfaultfd minor fault
609
611
ss shadow/guarded control stack page
610
612
sl sealed
613
+
lf lock on fault pages
614
+
dp always lazily freeable mapping
611
615
== =======================================
612
616
613
617
Note that there is no guarantee that every flag and associated mnemonic will
+1
MAINTAINERS
+1
MAINTAINERS
+3
drivers/rapidio/rio_cm.c
+3
drivers/rapidio/rio_cm.c
···
783
783
if (buf == NULL || ch_id == 0 || len == 0 || len > RIO_MAX_MSG_SIZE)
784
784
return -EINVAL;
785
785
786
+
if (len < sizeof(struct rio_ch_chan_hdr))
787
+
return -EINVAL; /* insufficient data from user */
788
+
786
789
ch = riocm_get_channel(ch_id);
787
790
if (!ch) {
788
791
riocm_error("%s(%d) ch_%d not found", current->comm,
+4
-2
include/linux/fs.h
+4
-2
include/linux/fs.h
···
2274
2274
return true;
2275
2275
}
2276
2276
2277
+
int compat_vma_mmap_prepare(struct file *file, struct vm_area_struct *vma);
2278
+
2277
2279
static inline int call_mmap(struct file *file, struct vm_area_struct *vma)
2278
2280
{
2279
-
if (WARN_ON_ONCE(file->f_op->mmap_prepare))
2280
-
return -EINVAL;
2281
+
if (file->f_op->mmap_prepare)
2282
+
return compat_vma_mmap_prepare(file, vma);
2281
2283
2282
2284
return file->f_op->mmap(file, vma);
2283
2285
}
+2
-2
include/linux/scatterlist.h
+2
-2
include/linux/scatterlist.h
···
99
99
* @sg: The current sg entry
100
100
*
101
101
* Description:
102
-
* Usually the next entry will be @sg@ + 1, but if this sg element is part
102
+
* Usually the next entry will be @sg + 1, but if this sg element is part
103
103
* of a chained scatterlist, it could jump to the start of a new
104
104
* scatterlist array.
105
105
*
···
254
254
* @sgl: Second scatterlist
255
255
*
256
256
* Description:
257
-
* Links @prv@ and @sgl@ together, to form a longer scatterlist.
257
+
* Links @prv and @sgl together, to form a longer scatterlist.
258
258
*
259
259
**/
260
260
static inline void sg_chain(struct scatterlist *prv, unsigned int prv_nents,
+1
init/initramfs.c
+1
init/initramfs.c
+1
init/main.c
+1
init/main.c
+4
-4
lib/scatterlist.c
+4
-4
lib/scatterlist.c
···
73
73
* Should only be used casually, it (currently) scans the entire list
74
74
* to get the last entry.
75
75
*
76
-
* Note that the @sgl@ pointer passed in need not be the first one,
77
-
* the important bit is that @nents@ denotes the number of entries that
78
-
* exist from @sgl@.
76
+
* Note that the @sgl pointer passed in need not be the first one,
77
+
* the important bit is that @nents denotes the number of entries that
78
+
* exist from @sgl.
79
79
*
80
80
**/
81
81
struct scatterlist *sg_last(struct scatterlist *sgl, unsigned int nents)
···
345
345
* @gfp_mask: GFP allocation mask
346
346
*
347
347
* Description:
348
-
* Allocate and initialize an sg table. If @nents@ is larger than
348
+
* Allocate and initialize an sg table. If @nents is larger than
349
349
* SG_MAX_SINGLE_ALLOC a chained sg table will be setup.
350
350
*
351
351
**/
+2
mm/madvise.c
+2
mm/madvise.c
···
508
508
pte_offset_map_lock(mm, pmd, addr, &ptl);
509
509
if (!start_pte)
510
510
break;
511
+
flush_tlb_batched_pending(mm);
511
512
arch_enter_lazy_mmu_mode();
512
513
if (!err)
513
514
nr = 0;
···
742
741
start_pte = pte;
743
742
if (!start_pte)
744
743
break;
744
+
flush_tlb_batched_pending(mm);
745
745
arch_enter_lazy_mmu_mode();
746
746
if (!err)
747
747
nr = 0;
+40
mm/util.c
+40
mm/util.c
···
1131
1131
}
1132
1132
EXPORT_SYMBOL(flush_dcache_folio);
1133
1133
#endif
1134
+
1135
+
/**
1136
+
* compat_vma_mmap_prepare() - Apply the file's .mmap_prepare() hook to an
1137
+
* existing VMA
1138
+
* @file: The file which possesss an f_op->mmap_prepare() hook
1139
+
* @vma: The VMA to apply the .mmap_prepare() hook to.
1140
+
*
1141
+
* Ordinarily, .mmap_prepare() is invoked directly upon mmap(). However, certain
1142
+
* 'wrapper' file systems invoke a nested mmap hook of an underlying file.
1143
+
*
1144
+
* Until all filesystems are converted to use .mmap_prepare(), we must be
1145
+
* conservative and continue to invoke these 'wrapper' filesystems using the
1146
+
* deprecated .mmap() hook.
1147
+
*
1148
+
* However we have a problem if the underlying file system possesses an
1149
+
* .mmap_prepare() hook, as we are in a different context when we invoke the
1150
+
* .mmap() hook, already having a VMA to deal with.
1151
+
*
1152
+
* compat_vma_mmap_prepare() is a compatibility function that takes VMA state,
1153
+
* establishes a struct vm_area_desc descriptor, passes to the underlying
1154
+
* .mmap_prepare() hook and applies any changes performed by it.
1155
+
*
1156
+
* Once the conversion of filesystems is complete this function will no longer
1157
+
* be required and will be removed.
1158
+
*
1159
+
* Returns: 0 on success or error.
1160
+
*/
1161
+
int compat_vma_mmap_prepare(struct file *file, struct vm_area_struct *vma)
1162
+
{
1163
+
struct vm_area_desc desc;
1164
+
int err;
1165
+
1166
+
err = file->f_op->mmap_prepare(vma_to_desc(vma, &desc));
1167
+
if (err)
1168
+
return err;
1169
+
set_vma_from_desc(vma, &desc);
1170
+
1171
+
return 0;
1172
+
}
1173
+
EXPORT_SYMBOL(compat_vma_mmap_prepare);
+4
-19
mm/vma.c
+4
-19
mm/vma.c
···
967
967
err = dup_anon_vma(next, middle, &anon_dup);
968
968
}
969
969
970
-
if (err)
970
+
if (err || commit_merge(vmg))
971
971
goto abort;
972
-
973
-
err = commit_merge(vmg);
974
-
if (err) {
975
-
VM_WARN_ON(err != -ENOMEM);
976
-
977
-
if (anon_dup)
978
-
unlink_anon_vmas(anon_dup);
979
-
980
-
/*
981
-
* We've cleaned up any cloned anon_vma's, no VMAs have been
982
-
* modified, no harm no foul if the user requests that we not
983
-
* report this and just give up, leaving the VMAs unmerged.
984
-
*/
985
-
if (!vmg->give_up_on_oom)
986
-
vmg->state = VMA_MERGE_ERROR_NOMEM;
987
-
return NULL;
988
-
}
989
972
990
973
khugepaged_enter_vma(vmg->target, vmg->flags);
991
974
vmg->state = VMA_MERGE_SUCCESS;
···
977
994
abort:
978
995
vma_iter_set(vmg->vmi, start);
979
996
vma_iter_load(vmg->vmi);
997
+
998
+
if (anon_dup)
999
+
unlink_anon_vmas(anon_dup);
980
1000
981
1001
/*
982
1002
* This means we have failed to clone anon_vma's correctly, but no
···
3112
3126
userfaultfd_unmap_complete(mm, &uf);
3113
3127
return ret;
3114
3128
}
3115
-
3116
3129
3117
3130
/* Insert vm structure into process list sorted by address
3118
3131
* and into the inode's i_mmap tree. If vm_file is non-NULL
+47
mm/vma.h
+47
mm/vma.h
···
222
222
return 0;
223
223
}
224
224
225
+
226
+
/*
227
+
* Temporary helper functions for file systems which wrap an invocation of
228
+
* f_op->mmap() but which might have an underlying file system which implements
229
+
* f_op->mmap_prepare().
230
+
*/
231
+
232
+
static inline struct vm_area_desc *vma_to_desc(struct vm_area_struct *vma,
233
+
struct vm_area_desc *desc)
234
+
{
235
+
desc->mm = vma->vm_mm;
236
+
desc->start = vma->vm_start;
237
+
desc->end = vma->vm_end;
238
+
239
+
desc->pgoff = vma->vm_pgoff;
240
+
desc->file = vma->vm_file;
241
+
desc->vm_flags = vma->vm_flags;
242
+
desc->page_prot = vma->vm_page_prot;
243
+
244
+
desc->vm_ops = NULL;
245
+
desc->private_data = NULL;
246
+
247
+
return desc;
248
+
}
249
+
250
+
static inline void set_vma_from_desc(struct vm_area_struct *vma,
251
+
struct vm_area_desc *desc)
252
+
{
253
+
/*
254
+
* Since we're invoking .mmap_prepare() despite having a partially
255
+
* established VMA, we must take care to handle setting fields
256
+
* correctly.
257
+
*/
258
+
259
+
/* Mutable fields. Populated with initial state. */
260
+
vma->vm_pgoff = desc->pgoff;
261
+
if (vma->vm_file != desc->file)
262
+
vma_set_file(vma, desc->file);
263
+
if (vma->vm_flags != desc->vm_flags)
264
+
vm_flags_set(vma, desc->vm_flags);
265
+
vma->vm_page_prot = desc->page_prot;
266
+
267
+
/* User-defined fields. */
268
+
vma->vm_ops = desc->vm_ops;
269
+
vma->vm_private_data = desc->private_data;
270
+
}
271
+
225
272
int
226
273
do_vmi_align_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma,
227
274
struct mm_struct *mm, unsigned long start,
+6
-1
tools/testing/selftests/mm/gup_longterm.c
+6
-1
tools/testing/selftests/mm/gup_longterm.c
···
298
298
log_test_start("%s ... with memfd", desc);
299
299
300
300
fd = memfd_create("test", 0);
301
-
if (fd < 0)
301
+
if (fd < 0) {
302
302
ksft_print_msg("memfd_create() failed (%s)\n", strerror(errno));
303
+
log_test_result(KSFT_SKIP);
304
+
return;
305
+
}
303
306
304
307
fn(fd, pagesize);
305
308
close(fd);
···
369
366
fd = memfd_create("test", flags);
370
367
if (fd < 0) {
371
368
ksft_print_msg("memfd_create() failed (%s)\n", strerror(errno));
369
+
log_test_result(KSFT_SKIP);
370
+
return;
372
371
}
373
372
374
373
fn(fd, hugetlbsize);
+16
tools/testing/vma/vma_internal.h
+16
tools/testing/vma/vma_internal.h
···
159
159
160
160
#define ASSERT_EXCLUSIVE_WRITER(x)
161
161
162
+
/**
163
+
* swap - swap values of @a and @b
164
+
* @a: first value
165
+
* @b: second value
166
+
*/
167
+
#define swap(a, b) \
168
+
do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0)
169
+
162
170
struct kref {
163
171
refcount_t refcount;
164
172
};
···
1474
1466
static inline void fixup_hugetlb_reservations(struct vm_area_struct *vma)
1475
1467
{
1476
1468
(void)vma;
1469
+
}
1470
+
1471
+
static inline void vma_set_file(struct vm_area_struct *vma, struct file *file)
1472
+
{
1473
+
/* Changing an anonymous vma with this is illegal */
1474
+
get_file(file);
1475
+
swap(vma->vm_file, file);
1476
+
fput(file);
1477
1477
}
1478
1478
1479
1479
#endif /* __MM_VMA_INTERNAL_H */